Privacy policy

Optional public website analytics

If you choose Allow analytics, Google Analytics uses first-party cookies to measure visits to our public information pages and clicks on trial or subscription links. These clicks do not confirm account creation or payment. Google processes device and browser information, approximate location and cookie identifiers to produce reports. We do not enable advertising personalization, Google signals or user-provided data collection.

Analytics is off until you agree. It is not loaded on account, checkout, invitation, SMS, private family-space or record-verification-result pages, or when a public page URL contains a query string or fragment. We send fixed public page names and limited referring-site information; we do not send names, email addresses, form contents, family records or account identifiers.

Your analytics choice is stored in this browser for up to 180 days. Analytics cookies expire after up to 180 days. Use Analytics settings in the public footer to change your choice or withdraw consent; withdrawal stops collection and removes this integration's analytics cookies from this browser. Browser Do Not Track and Global Privacy Control signals keep analytics off. Essential authentication and security storage remain separate.

Account data and previous beta applications

Account and service data includes your email, authentication records, messages and attachments, calendars, expenses and receipts, journal entries, vault files, professional grants, call-consent records and recordings, export snapshots, timestamps, delivery states, and security audit events.

The August beta application is closed. Previously submitted applications contain name, email, parent or professional role, state or country, feedback availability, consent versions, timestamps, and application status.

Retired public demo

The public demo and its AI endpoint are closed. They no longer accept draft text. Illustrations on the website use fictional details and do not represent a real family account.

Before retirement, the demo sent requested draft rewrites to Google Gemini and recorded limited security telemetry, including a keyed network-address hash, request identifier, action, model, status, safety outcome, latency, and token counts. The demo did not store draft text or responses in family records. This telemetry remains scheduled for cleanup after 48 hours, including after retirement. Cleanup runs hourly, so deletion is not immediate at the 48-hour mark.

Google Calendar data

If you connect Google Calendar, Google's permission allows read-only access to events on calendars you own. Mellow Family uses that permission only to read events from your primary calendar. For the visible overlay, it requests the Google event ID, title, description, start value, and end value, plus a pagination indicator used to show when results are incomplete. Mellow does not write to Google Calendar.

Overlay events are fetched from Google on demand and are not cached by the application. Mellow stores an encrypted refresh token, the granted scopes, and connection state so it can maintain the connection. It does not keep a persistent copy of an event unless you deliberately select Copy into Mellow. A copied event becomes a Mellow record and follows Mellow's retention rules.

Disconnect Google attempts to revoke the token with Google and removes the locally stored token. Once local disconnection is confirmed, Mellow stops new Google requests; requests already in progress may finish. The result separately reports whether Google confirmed revocation. Disconnecting also revokes your private Mellow calendar feed for that family; copied Mellow records remain. You can also revoke access from your Google Account permissions.

Google API Limited Use

Mellow Family's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google data is not sold, used for advertising, used for credit or lending decisions, or used to train generalized artificial-intelligence models. It is shared only as needed to provide the user-facing calendar feature, protect security, comply with law, or for another narrowly permitted purpose under Google's policy.

How we use and share information

We use information to provide, secure, support, and improve the features you request; process applications and payments; maintain records; communicate service notices; prevent abuse; and comply with law. Marketing email requires separate optional consent and is not required to apply or use the service.

Shared sections are visible to family-space members. Your private journal and private vault files remain under your control. A professional receives read-only access only to the sections explicitly authorized for them. We do not sell personal information or show advertising.

Supabase provides database, authentication, and storage infrastructure; Stripe processes payments; and Resend delivers transactional email. They receive only the information necessary to perform those services under their applicable terms and safeguards. Stripe, not Mellow Family, stores payment-card details.

Vercel hosts the application and processes requests and operational logs. Cloudflare provides domain and email-routing services; messages sent to our privacy, legal, and support addresses are forwarded to our support inbox.

Daily provides the audio-call service. When you join a call, it processes audio, connection information, your account identifier and the email used as your participant name. Recording requires both parents' recorded consent in Mellow. Recordings are processed by Daily and copied into our storage; the ingestion worker verifies the stored copy before requesting deletion of Daily's copy. Failed transfers or deletion requests require retries, so provider deletion is not immediate.

For independently timestamped exports, DigiCert receives a cryptographic fingerprint and timestamp-request information. The timestamp request does not contain the underlying family messages, receipts, or export document.

AI features

AI assistance starts off for new accounts unless the parent enables it. Manage AI assistance, Coach, and receipt scanning in Your account. Enabling a tool does not run it automatically. Turning AI off blocks new requests and subsequent retries; it cannot recall content already sent to a provider or erase existing records. Each parent controls their own account, not the other parent’s use of their own drafts.

We retain private tool choices and limited service-health metadata, such as an allowlisted error code, status, and time. AI service-health records contain no drafts, receipt images, generated text, or account identifiers. Navigation choices hide shortcuts without deleting records or changing notifications or sharing permissions.

When enabled, Mellow Coach and receipt scanning use Microsoft Azure OpenAI in the US Data Zone. Asking Coach to review a draft sends that draft and a hashed account identifier to Microsoft for processing. Receipt scanning sends the selected receipt image to Microsoft. These requests do not include the rest of your message history, journal, or vault. Suggestions are optional and can contain errors; review them before use.

Mellow does not train its own models on family content. Under the providers' applicable API terms, inputs and outputs are not used to train their general models without permission. Coach requests are processed within the United States. Our requests disable stored response objects; that setting does not eliminate provider security or abuse-monitoring retention or related review. Provider processing follows the applicable service terms. Contact privacy@mellow.family for questions about AI processing.

Private SMS pilot

We do not sell mobile information or share it with third parties or affiliates for marketing or promotional purposes. SMS opt-in and consent information is used only to provide the requested messaging service and its consent records. Providers such as Telnyx and mobile carriers receive the information needed to operate that service; SMS consent does not authorize unrelated marketing.

SMS sending is restricted while carrier registration and pilot testing are completed. If a recipient opts in using a phone-bound invitation code, Mellow records messages exchanged through the platform number, the participating phone numbers, consent and opt-out events, provider message identifiers, delivery events and capture timestamps. Telnyx and mobile carriers process phone numbers and message content for delivery.

These SMS records belong to the parent who set up the conversation. Other family-space members and professionals cannot directly read them. The parent may export and share the records. Delivery does not establish who used a phone or whether a message was read. Coach receives a draft only when the parent asks for review.

We retain consent, suppression and routing records to honor opt-outs and prevent messages being routed to another family. Opting out stops future sends but does not erase captured records or recall messages already handed to a carrier. Closing the account stops new body capture; existing records remain subject to our retention and verified privacy-request process. Contact privacy@mellow.family about a wrong or reassigned number.

Mobile numbers and SMS consent are not sold or shared for third-party marketing. They are used by the service providers necessary to deliver messages and operate the feature.

Retention, deletion, and shared records

We remove unneeded beta screening fields when their scheduled retention period ends. If no deletion date was set, that period is one year from the application date. We may retain limited suppression, consent, entitlement, security, and financial records when necessary to honor choices, provide benefits, prevent abuse, or meet legal obligations.

Sent messages and journal entries are append-only by design; calendar and expense corrections create revisions. Closing an account does not erase shared records from another family-space member. Copied Google events follow these same Mellow retention rules.

You may request access, correction, disconnection, or deletion by emailing privacy@mellow.family. We verify requests and respond subject to shared-record integrity and applicable legal retention duties.

Owners can delete standalone private vault files through the app. Files attached to retained records follow those records' retention rules. Removing professional access prevents new authorized requests; a download link already issued can work until it expires, and we cannot recall files someone has already downloaded.

File uploads use private temporary copies while we verify the transfer. Temporary copies, including unsaved receipt scans and copies of a deleted vault file, are scheduled for cleanup after 48 hours. Failed cleanup attempts are retried and monitored. A receipt scan does not create a shared expense record until you save it.

Security

Data is encrypted in transit and at rest. Access is restricted by row-level database controls, service roles, authorization checks, and logged administrative operations. No security program can guarantee absolute protection.

Contact

Privacy questions and requests: privacy@mellow.family.